Privacy Policy
Effective 1st of September 2026. Last updated 2nd of November 2026.
Eqvesta Inc. ("Eqvesta," "we," "us") runs eqvesta.com and the Eqvesta web app (together, the "Service"). This policy explains what personal information we collect, how our AI features use it, who we share it with, and the choices you have.
The short version
- You tell us about your accounts, equity and income so we can work out which deadlines apply to you.
- Before your text reaches an AI model, our system is designed to replace your name, contact details, tax IDs and account numbers with placeholder tags.
- We do not ask for bank logins, we cannot move money, and we do not sell your personal information.
- We do not use your data to train AI models, and we do not let our AI providers do so.
- We share data only with the types of service providers described in section 6, and only to run the Service.
1. Who this policy covers
This policy applies to visitors to eqvesta.com, people who join our waitlist, and people who create an account. Eqvesta Inc. is the controller of your personal information. Eqvesta is a Delaware corporation with its registered address at 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States.
2. Information we collect
Information you give us
| Category | Examples | Why we need it |
|---|---|---|
| Account | Email address, password (stored as a hash), or your Google account ID and email if you sign in with Google | To create and secure your account |
| Your situation | Tax residency, whether you are a U.S. person, types of equity you hold (ISO, NSO, RSU, early-exercised shares), key dates (grant, exercise, purchase, leaving a job), whether you have income without tax withheld, accounts held outside the U.S., tax year | To work out which deadlines apply to you |
| Your assets and debts | Account types and approximate value ranges you choose to enter | To show your overview and net worth estimate |
| Messages | Questions you type to our AI agents and the answers they give | To answer you and keep your history |
| Documents | Files you upload or import from Google Drive | To read the details needed for your deadlines and drafts |
| Billing | Name, email and subscription details (card details go straight to Stripe and never reach our servers) | To charge your subscription |
| Communications | Waitlist sign-ups, support emails, feedback | To reply and keep you updated |
What we do not collect
- Logins or passwords for your bank, brokerage or retirement accounts.
- Full payment card numbers.
- Personal identity fields on drafted tax forms. Fields such as your name, address and taxpayer ID number (SSN, ITIN) are left blank in drafts for you to fill in yourself, and we do not store them.
Information collected automatically
- Technical data: IP address, browser and device type, pages visited, time of request, country, and response codes.
- Security data: requests that our firewall blocks or rate-limits.
- Cookies and similar technologies (section 9).
3. How we use your information
- To run the Service: calculate dates, write step-by-step to-do lists, draft paperwork for you and your tax professional to review, and answer your questions.
- To send service emails: account verification, password resets, and deadline reminders.
- To bill your subscription.
- To keep the Service secure: prevent fraud, abuse and attacks, and fix errors.
- To improve the Service using usage statistics and aggregated or de-identified information.
- To send product news and offers, with your consent where the law requires it. You can unsubscribe at any time.
- To meet legal obligations and enforce our Terms.
For users in the EU, EEA, UK and Switzerland, our legal bases are: performing our contract with you (running the Service), our legitimate interests (security, error monitoring, improving the Service), your consent (marketing, non-essential cookies, special categories of data you choose to share), and legal obligations.
4. How we use AI
Eqvesta uses large language models ("LLMs") from established third-party AI providers to read your questions and documents and write answers, steps and drafts. Deadlines themselves are calculated by our own code from the rules, not guessed by the model.
What is sent to an AI provider
- The text of your question.
- Category-level facts about your situation, such as U.S. person status, equity type, relevant dates and tax year.
- Excerpts from official sources in our knowledge base, such as IRS publications.
- Deadline dates our code has calculated.
- The content of a document you have uploaded or imported, when you ask us to process it.
What we do to protect it before sending
- Automatic masking. Before each call to an AI provider, our system scans the text for names, email addresses, phone numbers, postal addresses, dates of birth, tax ID numbers (SSN, ITIN, EIN), account and card numbers, IBANs, and passport or national ID numbers. It replaces each one with a placeholder tag, such as [TAX_ID_1]. Your profile name and email are always masked, not only when detected.
- Restored in memory only. When the answer comes back, the tags are swapped back to the real values in memory for that one request. The tag-to-value table is never saved to our database, logs or error reports.
- Fail-closed. If masking fails, the request is not sent.
- No amounts in chat. Our agents are instructed not to ask for account balances or amounts.
Masking relies on automated detection and may not catch every detail, especially in unusual document formats. Please do not upload documents containing information the Service does not need.
How AI providers handle your data
We access these models through their business APIs. We only use AI providers whose business terms prohibit them from using our data to train their models. [CONFIRM: this holds for each account and tier in use; Gemini's free API tier, for example, may allow training.] [LLM PROVIDER RETENTION: state whether zero-data-retention is enabled, or the retention period each provider applies for abuse monitoring, and confirm DPAs.] We do not use your personal information to train or fine-tune any AI model. We use AI embedding models only to index our own knowledge base of official sources, never your data.
AI output can be wrong
AI-generated answers and drafts can contain mistakes. They are not legal, tax or investment advice, and they are not decisions with legal effect about you. You and your tax professional make the decisions. See our Terms.
5. Google Drive
If you connect Google Drive, we request access only to the files you choose to import. [CONFIRM: the OAuth scope matches this, for example drive.file rather than full Drive read access.] We read file names and types, and download a file's content only to process it for you. File content passes through to our AI pipeline (with masking as described in section 4) and is not saved on our servers. Documents we generate from it are saved to your account.
We store your Google access and refresh tokens in encrypted form. You can disconnect at any time in your account settings or in your Google account permissions.
Eqvesta's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine learning models.
6. Who we share information with
We share personal information only with the service providers below, under contracts that limit their use of it to providing services to us.
| Type of provider | What it does | What it receives |
|---|---|---|
| Cloud hosting and storage | Hosts our database, servers and files | All data stored in your account |
| Network security and delivery | Encrypts and protects site traffic, blocks attacks and bots | All traffic in transit; keeps IP addresses and request metadata in its logs |
| AI model providers | Read and write text for our AI agents | Masked questions, situation facts and document content (section 4) |
| Sign-in and file services you choose to connect, such as Google | Let you sign in or import documents | Your account ID and email with that service; files you import |
| Payment processor | Handles payments and subscriptions | Your email, our user ID, subscription details, card details you enter on its page |
| Email delivery | Sends account and reminder emails | Your email address and the email content, such as a verification link or a deadline name and date |
| Error monitoring | Helps us find and fix bugs | Error details and your user ID only; no email, messages or request contents |
| Analytics and advertising | Measures site use and ad performance | Cookie IDs, pages visited, device data |
A current list of the specific providers we use is available on request at [email protected]. We update it when our providers change.
We may also disclose information:
- to our legal, accounting and other professional advisers, under confidentiality;
- if the law requires it, or to protect the rights, property or safety of users, Eqvesta or others;
- as part of a merger, acquisition, financing or sale of assets, subject to this policy;
- with your consent or at your direction, for example when you share a CPA package with your tax professional.
We do not sell your personal information. If ad pixels are used: We may "share" limited online identifiers with advertising partners for cross-context behavioral advertising, as defined by California law. You can opt out as described in section 11.
7. What we keep on our own systems
Your account, profile, the situation and asset details you enter, your chat history with our agents, documents you upload and their metadata, documents we draft for you, and your subscription status are stored in our database and file storage with our cloud hosting provider. Our logs and error reports are configured to exclude the contents of your messages.
8. Where your data is stored and international transfers
Your account data is stored with our cloud hosting provider in [REGION]. Our network security provider routes traffic through the data center nearest to you. Other providers, including our AI, payment, email and error-monitoring providers, may process data in the United States or other countries.
When we transfer personal information from the EU, EEA, UK or Switzerland to the United States, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
9. Cookies
| Cookie type | Set by | Purpose | Can you turn it off? |
|---|---|---|---|
| Session | Eqvesta | Keeps you signed in | No, strictly necessary |
| Security | Our network security provider | Detects bots and remembers that you passed a security check | No, strictly necessary |
| Analytics | Our analytics providers | Shows us how the site is used | Yes |
| Advertising | Our advertising partners | Measures ad performance and may show you our ads elsewhere | Yes |
You can see the specific cookies in use, and change your choices, in our cookie settings [COOKIE SETTINGS LINK].
Strictly necessary cookies cannot be switched off. Where the law requires it, we ask for your consent before setting optional cookies, and you can change your choice at any time. You can also block cookies in your browser settings.
10. How long we keep information
- Account, profile and history: while your account is open, then deleted within [RETENTION PERIODS] after you close it.
- Billing records: as long as tax and accounting law requires, typically 7 years.
- Security and error logs: [RETENTION PERIODS].
- Waitlist data: until you unsubscribe or we launch and you choose not to join.
We may keep information longer if needed to resolve disputes or meet a legal obligation.
11. Your rights and choices
Depending on where you live, you may have the right to:
- know what personal information we hold and get a copy of it;
- correct inaccurate information;
- delete your information;
- receive your information in a portable format;
- opt out of targeted advertising, "sharing" and the sale of personal information (we do not sell it);
- limit our use of sensitive personal information;
- withdraw consent at any time, without affecting earlier processing;
- object to or restrict processing, if you are in the EU, EEA, UK or Switzerland.
To exercise these rights, email [email protected]. We will verify your identity before acting, respond within the time the law requires (usually 30 to 45 days), and tell you how to appeal if we decline. You may use an authorized agent. We will not discriminate against you for exercising your rights. We honor Global Privacy Control signals as an opt-out of sharing for advertising.
If you are in the EU, EEA, UK or Switzerland, you may also complain to your local data protection authority.
Sensitive information. Some data you enter, such as financial details, tax status and tax ID numbers inside documents, is sensitive under some state laws. We use it only to provide the Service you asked for.
12. Security
We use encryption in transit, encrypt stored third-party tokens, restrict staff access to internal tools, run a web application firewall and rate limiting, and keep message contents out of our logs. No system is completely secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
13. Children
The Service is only for people aged 18 or older. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.
14. Changes to this policy
We will post any update here with a new "Last updated" date. If a change is material, we will email account holders before it takes effect.
15. Contact us
Eqvesta Inc., 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. Email: [email protected].